The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The skill instructs the user to install a post-checkout hook that automatically executes setup.sh or scripts/setup.sh from the repository root.
Evidence: The documentation in SKILL.md and setup-guide.md explicitly states that it runs these scripts if present.
Risk: Malicious repositories can include a setup.sh to execute arbitrary commands immediately upon the user running git worktree add.
[REMOTE_CODE_EXECUTION] (HIGH): The installed hook automatically detects and runs package managers (npm, yarn, pip, cargo, go, bundle) to install dependencies.
Evidence: SKILL.md section 'Package Manager Detection' lists automatic execution of install commands for multiple languages.
Risk: Many package managers execute lifecycle scripts (e.g., postinstall in npm) during the installation process, providing another vector for automatic RCE from untrusted repositories.
[EXTERNAL_DOWNLOADS] (MEDIUM): The hook triggers network operations to fetch packages from public registries (PyPI, npm, etc.) automatically.
Risk: This facilitates supply chain attacks and unexpected data usage without user intervention during a standard git operation.
[CREDENTIALS_UNSAFE] (LOW): The hook is designed to automatically copy .env and .env.local files across worktrees.
Risk: While a convenience feature, it automates the duplication of sensitive credentials, potentially exposing them if the new worktree environment is less secure or if the setup scripts it triggers are malicious.

worktree-setup-hook